@phnx-labs/agents-cli 1.22.43 → 1.22.44

package/dist/commands/setup.js

@@ -26,6 +26,7 @@ import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
 import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
 import { registerAliasCommand } from './alias.js';
+import { registerBetaCommands } from './beta.js';
 import { runPreferencesStep } from './setup-preferences.js';
 import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
@@ -363,7 +364,7 @@ export function registerSetupCommand(program) {
         .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|mine|secrets|fleet|alias`.
+    // Capability subcommands: `agents setup browser|computer|mine|secrets|fleet|alias|beta`.
     // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
     // the hub below still offers it as a phase via runShareWizard.
     registerSetupBrowserCommand(setupCmd);
@@ -373,6 +374,7 @@ export function registerSetupCommand(program) {
     registerSetupFleetCommand(setupCmd);
     registerSetupWatchdogCommand(setupCmd);
     registerAliasCommand(setupCmd);
+    registerBetaCommands(setupCmd);
     setupCmd.command('status')
         .description('Show setup readiness for core, browser, computer, secrets, fleet, share, watchdog, and preferences.')
         .option('--json', 'print machine-readable JSON')
@@ -400,6 +402,7 @@ export function registerSetupCommand(program) {
       agents setup fleet
       agents setup watchdog
       agents setup alias add teams
+      agents setup beta enable factory
     `,
         notes: `
       What it does:
@@ -416,6 +419,7 @@ export function registerSetupCommand(program) {
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass
         agents setup alias add teams  # PATH shorthand: teams runs agents teams
+        agents setup beta enable factory  # opt into preview features
 
       To install CLIs from agents.yaml and sync resources into version homes:
         agents sync --local -y

package/dist/commands/share.d.ts

@@ -105,7 +105,7 @@ export interface ShareRevisionsResult {
  * outdated-template hint as {@link parseShareListing}) on an unexpected shape. */
 export declare function parseShareRevisions(key: string, body: string): ShareRevisionsResult;
 /** Fetch and parse the retained prior versions of one published slug. `target`
- * accepts the same three forms as `agents unshare` (a full URL, `<user>/<slug>`,
+ * accepts the same three forms as `agents artifacts unshare` (a full URL, `<user>/<slug>`,
  * or a bare slug resolved against the caller's own namespace) — reuses
  * {@link resolveDeleteTarget} rather than re-deriving the key. */
 export declare function runShareRevisions(target: string, opts?: {
@@ -119,11 +119,11 @@ interface ShareDeleteCliOpts {
     keepCover?: boolean;
     keepRevisions?: boolean;
     ifExists?: boolean;
-    githubUser?: string;
-    json?: boolean;
+    forUser?: string;
+    deleteJson?: boolean;
 }
 /** Shared handler for `agents artifacts share delete <targets...>` and the
- * top-level `agents unshare <targets...>` alias. Deletes each target independently and
+ * nested `agents artifacts unshare <targets...>` alias. Deletes each target independently and
  * continues past a failed one (rm-style), reporting all results and exiting
  * non-zero if any target failed to verify as gone.
  *
@@ -133,18 +133,17 @@ interface ShareDeleteCliOpts {
 export declare function runShareDelete(targets: string[], opts: ShareDeleteCliOpts, deleteFn?: typeof deleteShare): Promise<void>;
 /**
  * Register the `share` subtree under its parent group — `agents artifacts share`
- * (see commands/artifacts.ts). The top-level `agents unshare` alias is a sibling
+ * (see commands/artifacts.ts). `agents artifacts unshare` is the nested alias
+ * registered via {@link registerUnshareCommand} on the artifacts group.
  * registration on the ROOT program, so it is {@link registerUnshareCommand}, not
  * part of this subtree.
  */
 export declare function registerShareCommands(artifactsCmd: Command): void;
 /**
- * Register the top-level `agents unshare <targets...>` alias of
- * `agents artifacts share delete`. It takes the ROOT program (not the artifacts
- * group) because it is deliberately a top-level convenience verb — taking a page
- * down is the one artifact action typed often enough to keep at the root.
+ * Register `agents artifacts unshare <targets...>` as the nested alias of
+ * `agents artifacts share delete`. Top-level `agents unshare` is retired.
  */
-export declare function registerUnshareCommand(program: Command): void;
+export declare function registerUnshareCommand(artifactsCmd: Command): void;
 /** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
  * endpoint config + write token. Shared by both modes of `agents artifacts setup`
  * (the flag-driven provision and the interactive wizard). */

package/dist/commands/share.js

@@ -235,7 +235,7 @@ export function parseShareRevisions(key, body) {
     return { key, count: revisions.length, revisions };
 }
 /** Fetch and parse the retained prior versions of one published slug. `target`
- * accepts the same three forms as `agents unshare` (a full URL, `<user>/<slug>`,
+ * accepts the same three forms as `agents artifacts unshare` (a full URL, `<user>/<slug>`,
  * or a bare slug resolved against the caller's own namespace) — reuses
  * {@link resolveDeleteTarget} rather than re-deriving the key. */
 export async function runShareRevisions(target, opts = {}) {
@@ -296,7 +296,7 @@ export function formatShareDeleteResult(result, json = false) {
     return lines.join('\n');
 }
 /** Shared handler for `agents artifacts share delete <targets...>` and the
- * top-level `agents unshare <targets...>` alias. Deletes each target independently and
+ * nested `agents artifacts unshare <targets...>` alias. Deletes each target independently and
  * continues past a failed one (rm-style), reporting all results and exiting
  * non-zero if any target failed to verify as gone.
  *
@@ -311,19 +311,19 @@ export async function runShareDelete(targets, opts, deleteFn = deleteShare) {
                 keepCover: opts.keepCover === true,
                 keepRevisions: opts.keepRevisions === true,
                 ifExists: opts.ifExists === true,
-                githubUser: opts.githubUser,
+                githubUser: opts.forUser,
             });
             results.push({ target, result });
-            if (!opts.json)
+            if (!opts.deleteJson)
                 console.log(formatShareDeleteResult(result));
         }
         catch (e) {
             results.push({ target, error: e.message });
-            if (!opts.json)
+            if (!opts.deleteJson)
                 console.error(chalk.red(`${target}: ${e.message}`));
         }
     }
-    if (opts.json) {
+    if (opts.deleteJson) {
         console.log(JSON.stringify(results, null, 2));
     }
     if (results.some((r) => r.error)) {
@@ -335,8 +335,17 @@ function registerShareDeleteOptions(cmd) {
         .option('--keep-cover', 'leave the sibling <slug>.png OG cover in place (default: delete it too)')
         .option('--keep-revisions', 'leave retained revisions (<slug>/rev-*) in place (default: delete them too)')
         .option('--if-exists', 'treat an already-missing target as a no-op success instead of an error')
-        .option('--github-user <user>', 'GitHub username for resolving a bare-slug target (default: resolved from gh/git config)')
-        .option('--json', 'emit machine-readable results');
+        // Named --for-user / --delete-json, not --github-user / --json: `share
+        // <file>` (the parent of the nested `share delete`) already owns both
+        // those long names, and commander resolves an option's long name against
+        // the WHOLE ancestor chain — a same-named child option is silently
+        // dropped at parse time even when it parses alone (RUSH-2687; verified
+        // with a real program.parseAsync(), see share.test.ts). Matches the
+        // `revisions` precedent (--for-user/--revisions-json) below, and applies
+        // equally to the top-level `unshare` alias so both spellings stay
+        // identical even though `unshare` itself has no ancestor collision.
+        .option('--for-user <user>', 'GitHub username for resolving a bare-slug target (default: resolved from gh/git config)')
+        .option('--delete-json', 'emit machine-readable results');
 }
 const SHARE_DELETE_EXAMPLES = `
       # Delete by full URL — also takes down the sibling OG cover and any retained revisions
@@ -344,19 +353,19 @@ const SHARE_DELETE_EXAMPLES = `
 
       # Delete by <user>/<slug>, or a bare slug in your own namespace
       agents artifacts share delete octocat/my-plan-a1b2
-      agents unshare my-plan-a1b2
+      agents artifacts unshare my-plan-a1b2
 
       # Several at once
-      agents unshare my-plan-a1b2 old-report-9f3c
+      agents artifacts unshare my-plan-a1b2 old-report-9f3c
 
       # Keep the cover image up (rare — you usually want both gone)
-      agents unshare my-plan-a1b2 --keep-cover
+      agents artifacts unshare my-plan-a1b2 --keep-cover
 
       # Keep retained revisions up too (rare — they're world-readable by URL like the page itself)
-      agents unshare my-plan-a1b2 --keep-revisions
+      agents artifacts unshare my-plan-a1b2 --keep-revisions
 
       # Don't error if it's already gone
-      agents unshare my-plan-a1b2 --if-exists
+      agents artifacts unshare my-plan-a1b2 --if-exists
 `;
 const SHARE_DELETE_NOTES = `
   A follow-up GET is required to resolve 404 before this reports success — the
@@ -369,11 +378,12 @@ const SHARE_DELETE_NOTES = `
   down. Pass --keep-revisions to leave them (they still expire via the bucket's
   lifecycle rule on their own schedule either way).
 
-  agents artifacts share delete === agents unshare (same command, different name).
+  agents artifacts share delete === agents artifacts unshare (same command, different name).
 `;
 /**
  * Register the `share` subtree under its parent group — `agents artifacts share`
- * (see commands/artifacts.ts). The top-level `agents unshare` alias is a sibling
+ * (see commands/artifacts.ts). `agents artifacts unshare` is the nested alias
+ * registered via {@link registerUnshareCommand} on the artifacts group.
  * registration on the ROOT program, so it is {@link registerUnshareCommand}, not
  * part of this subtree.
  */
@@ -471,7 +481,7 @@ ${SHARE_DELETE_NOTES}
     });
     const shareDeleteCmd = registerShareDeleteOptions(shareCmd
         .command('delete <targets...>')
-        .description('Take down a published page (and by default its OG cover). Verifies the page 404s before reporting success. Top-level alias: agents unshare.'));
+        .description('Take down a published page (and by default its OG cover). Verifies the page 404s before reporting success. Nested alias: agents artifacts unshare.'));
     setHelpSections(shareDeleteCmd, { examples: SHARE_DELETE_EXAMPLES, notes: SHARE_DELETE_NOTES });
     shareDeleteCmd.action(async (targets, opts) => {
         await runShareDelete(targets, opts);
@@ -497,11 +507,15 @@ ${SHARE_DELETE_NOTES}
         .option('--account <id>', 'Cloudflare account id override (default: the configured endpoint\'s account)')
         .option('--token <t>', 'Cloudflare API token (else read from --bundle)')
         .option('--force', 're-deploy even if the deployed template already matches')
-        .option('--json', 'emit a machine-readable result')
+        // Named --update-json, not --json: `share <file>` (the parent) already
+        // owns --json for its own publish-time result. Commander resolves an
+        // option's long name against the WHOLE ancestor chain, so a same-named
+        // child option is silently dropped at parse time (RUSH-2687).
+        .option('--update-json', 'emit a machine-readable result')
         .action(async (opts) => {
         try {
             const result = await runShareUpdate(opts);
-            if (opts.json) {
+            if (opts.updateJson) {
                 console.log(JSON.stringify(result, null, 2));
                 return;
             }
@@ -541,7 +555,10 @@ ${SHARE_DELETE_NOTES}
             return;
         }
         console.log(`${chalk.bold('endpoint')}  ${chalk.green(cfg.baseUrl)}`);
-        console.log(chalk.dim(`worker ${cfg.workerName} · bucket ${cfg.bucketName} · account ${cfg.accountId}`));
+        console.log(chalk.dim(`worker ${cfg.workerName} · bucket ${cfg.bucketName} · account ${cfg.accountId || 'missing'}`));
+        if (!cfg.accountId) {
+            console.log(chalk.dim('account id empty — publish still uses baseUrl + WRITE_TOKEN; `agents artifacts share update` needs --account or join'));
+        }
         const user = await resolveGitHubUsername();
         console.log(`${chalk.bold('namespace')} ${user ? chalk.cyan(`${cfg.baseUrl}/${user}`) : chalk.yellow('unknown — set gh auth or github.user')}`);
         console.log(`${chalk.bold('analytics')} ${analyticsEnabled(cfg) ? chalk.green('enabled') : chalk.dim('not configured')}`);
@@ -555,28 +572,31 @@ ${SHARE_DELETE_NOTES}
     });
     const shareListCmd = shareCmd
         .command('list')
-        .description("List the pages you've published to your share namespace (human table; --json for scripts).")
-        .option('--github-user <user>', 'GitHub username whose namespace to list (default: resolved from gh/git config)')
+        .description("List the pages you've published to your share namespace (human table; --list-json for scripts).")
+        // Named --for-user / --list-json, not --github-user / --json: `share
+        // <file>` (the parent) already owns both those long names, and commander
+        // resolves an option's long name against the WHOLE ancestor chain — a
+        // same-named child option is silently dropped at parse time even when it
+        // parses alone (RUSH-2687; verified with a real program.parseAsync(), see
+        // share.test.ts). Matches the `revisions` precedent (--for-user/
+        // --revisions-json) and the `delete`/`unshare` precedent (--for-user/
+        // --delete-json) below.
+        .option('--for-user <user>', 'GitHub username whose namespace to list (default: resolved from gh/git config)')
         .option('--agent <name>', 'filter to shares published by this agent/harness (case-insensitive)')
         .option('--session <id>', 'filter to shares published from this session id')
         // Named --label-contains, not --label: `share <file>` (the parent) already owns
-        // `--label`/`--title`, and commander's argv scanner resolves an option name
-        // against the WHOLE ancestor chain, not per-command — a same-named child option
-        // is silently dropped (verified; see RUSH-2683 PR notes). Fixing that properly
-        // needs `enablePositionalOptions()` on the root program, a CLI-wide change out
-        // of scope here (a pre-existing instance of it already affects --json/
-        // --github-user on list/update/delete — tracked as a follow-up).
+        // `--label`/`--title`, same collision class as --for-user/--list-json above.
         .option('--label-contains <substr>', 'filter to shares whose label contains this text (case-insensitive)')
-        .option('--json', 'emit the machine-readable listing (slug, url, size, contentType, publishedAt, expiresAt, label, agent, session, host, repo, revisionCount, meta)')
+        .option('--list-json', 'emit the machine-readable listing (slug, url, size, contentType, publishedAt, expiresAt, label, agent, session, host, repo, revisionCount, meta)')
         .action(async (opts) => {
         try {
             const result = await runShareList({
-                githubUser: opts.githubUser,
+                githubUser: opts.forUser,
                 agent: opts.agent,
                 session: opts.session,
                 label: opts.labelContains,
             });
-            console.log(formatShareList(result, Boolean(opts.json)));
+            console.log(formatShareList(result, Boolean(opts.listJson)));
         }
         catch (e) {
             console.error(chalk.red(e.message));
@@ -589,10 +609,10 @@ ${SHARE_DELETE_NOTES}
       agents artifacts share list
 
       # Machine-readable — e.g. pull every still-public URL with jq
-      agents artifacts share list --json | jq -r '.objects[].url'
+      agents artifacts share list --list-json | jq -r '.objects[].url'
 
       # List another namespace
-      agents artifacts share list --github-user octocat
+      agents artifacts share list --for-user octocat
 
       # Narrow by who/what published it
       agents artifacts share list --agent claude
@@ -606,22 +626,19 @@ ${SHARE_DELETE_NOTES}
   artifacts share update' (RUSH-2449) rather than returning a wrong or empty result
   — see 'agents artifacts share status' for whether an update is due.
 
-  --agent/--session/--label-contains filter the fetched listing client-side; --json's
-  count reflects the filtered set.
+  --agent/--session/--label-contains filter the fetched listing client-side;
+  --list-json's count reflects the filtered set.
     `,
     });
     const shareRevisionsCmd = shareCmd
         .command('revisions <target>')
         .description('Show the retained prior versions of a published slug, newest first (human table; --revisions-json for scripts).')
         // Named --for-user / --revisions-json, not --github-user / --json: `share
-        // <file>` (the parent) already owns both those long names, and commander's
-        // argv scanner resolves an option name against the WHOLE ancestor chain —
-        // a same-named child option is silently dropped even when it parses alone
-        // (verified with a real program.parseAsync(), see share.test.ts). Unlike
-        // `list`'s pre-existing --json/--github-user collision (RUSH-2687, left
-        // as a tracked follow-up because it predates this diff), `revisions` is
-        // brand-new here, so it gets non-colliding names from the start instead
-        // of shipping a silently-broken flag.
+        // <file>` (the parent) already owns both those long names, and commander
+        // resolves an option's long name against the WHOLE ancestor chain — a
+        // same-named child option is silently dropped at parse time even when it
+        // parses alone (RUSH-2687; verified with a real program.parseAsync(), see
+        // share.test.ts). Same collision class as `list`/`update`/`delete` above.
         .option('--for-user <user>', 'GitHub username for resolving a bare-slug target (default: resolved from gh/git config)')
         .option('--revisions-json', 'emit the machine-readable revision list')
         .action(async (target, opts) => {
@@ -639,7 +656,7 @@ ${SHARE_DELETE_NOTES}
       # Prior versions kept under this slug (bare slug — your own namespace)
       agents artifacts share revisions q3-report
 
-      # By <user>/<slug> or full URL, same target forms as 'agents unshare'
+      # By <user>/<slug> or full URL, same target forms as 'agents artifacts unshare'
       agents artifacts share revisions octocat/q3-report
       agents artifacts share revisions https://share.agents-cli.sh/octocat/q3-report
 
@@ -682,13 +699,11 @@ ${SHARE_DELETE_NOTES}
     });
 }
 /**
- * Register the top-level `agents unshare <targets...>` alias of
- * `agents artifacts share delete`. It takes the ROOT program (not the artifacts
- * group) because it is deliberately a top-level convenience verb — taking a page
- * down is the one artifact action typed often enough to keep at the root.
+ * Register `agents artifacts unshare <targets...>` as the nested alias of
+ * `agents artifacts share delete`. Top-level `agents unshare` is retired.
  */
-export function registerUnshareCommand(program) {
-    const unshareCmd = registerShareDeleteOptions(program
+export function registerUnshareCommand(artifactsCmd) {
+    const unshareCmd = registerShareDeleteOptions(artifactsCmd
         .command('unshare <targets...>')
         .description('Alias of `agents artifacts share delete` — take down a published page (and by default its OG cover).'));
     setHelpSections(unshareCmd, { examples: SHARE_DELETE_EXAMPLES, notes: SHARE_DELETE_NOTES });
@@ -778,12 +793,15 @@ export async function runShareUpdate(opts = {}) {
         accountId: opts.account,
     });
     const accountId = opts.account || acctFromBundle || cfg.accountId;
+    if (!accountId) {
+        throw new Error("Share endpoint has no Cloudflare account id — `agents artifacts share update` cannot call the API. Pass --account <id>, or re-run 'agents artifacts share join'.");
+    }
     const writeToken = readWriteToken();
     const script = renderWorkerScript();
     const provisionOpts = { ...(opts.request ? { request: opts.request } : {}), force: opts.force };
     const result = await updateWorker(apiToken, accountId, cfg.workerName, cfg.bucketName, script, writeToken, cfg.templateHash, provisionOpts);
     if (!result.skipped) {
-        writeShareConfig({ ...cfg, templateHash: result.templateHash });
+        writeShareConfig({ ...cfg, accountId, templateHash: result.templateHash });
     }
     return { updated: !result.skipped, templateHash: result.templateHash, baseUrl: cfg.baseUrl, workerName: cfg.workerName };
 }

package/dist/commands/skills.js

@@ -403,7 +403,7 @@ Examples:
         }
         else {
             console.log(chalk.green(`\nRemoved ${removed} skill(s) from version homes.`));
-            console.log(chalk.gray('Central source unchanged. Skills will re-sync on next agent launch.'));
+            console.log(chalk.gray("Central source unchanged. Restore any target with 'agents sync <agent>@<version> --yes'."));
         }
     });
     // `skills prune` moved to the top-level `agents prune cleanup` command.

package/dist/commands/ssh.js

@@ -24,8 +24,6 @@ import { registerFleetApplyAlias } from './apply.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, writeReachability, } from '../lib/devices/registry.js';
 import { resolveDeviceProfile } from '../lib/devices/resolve-profile.js';
 import { collectReachabilityWriteBacks, deviceOnlineState } from '../lib/devices/reachability.js';
-import { addControlToken } from '../lib/serve/token.js';
-import { DEFAULT_SERVE_PORT } from '../lib/serve/server.js';
 import { nodeToDeviceInput, parseTailscaleStatus, tailscaleStatusJson, } from '../lib/devices/tailscale.js';
 import { defaultPickerChecked, localLoginUser, planDeviceReconciliation, runDeviceSync, withDefaultUser } from '../lib/devices/sync.js';
 import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-target.js';
@@ -41,7 +39,7 @@ import { fanOutDevices, fleetHealthSkip, planFleetTargets, remoteFleetTargets, r
 import { isRolloutSuccess, verifyFleetRollout, } from '../lib/devices/rollout-verify.js';
 import { fleetCapacity, fmtBytes, headroom, } from '../lib/devices/health.js';
 import { buildFleetHealthReport, renderFleetMatrix, renderFleetSummary, renderFleetWarnings, } from '../lib/devices/health-report.js';
-import { loadFleetStats, readStatsCache } from '../lib/devices/stats-cache.js';
+import { isFreshDeviceStats, loadFleetStats, readStatsCache } from '../lib/devices/stats-cache.js';
 import { collectLocalFleetInventory } from '../lib/devices/fleet-inventory.js';
 import { checkSyncStatus, countOrphans } from '../lib/drift.js';
 import { checkAllClis } from '../lib/teams/agents.js';
@@ -661,8 +659,11 @@ async function runFleetPing(opts) {
     const self = machineId();
     const { refreshLocalFleetAuthState } = await import('../lib/daemon-ticks.js');
     // --local: probe just this host. Used both directly and as the fan-out worker.
+    // force: this command promises "a real request for every account" (--strict
+    // gates on it), so it must never reuse the periodic tick's rate-limit-throttled
+    // cached verdict (RUSH-2998).
     if (opts.local) {
-        const { authRows: rows } = await refreshLocalFleetAuthState();
+        const { authRows: rows } = await refreshLocalFleetAuthState({ force: true });
         if (opts.json) {
             console.log(JSON.stringify({ host: self, rows }));
         }
@@ -679,7 +680,12 @@ async function runFleetPing(opts) {
     const reg = await loadDevices();
     const planned = planFleetTargets(reg);
     const results = [];
-    const { authRows: localRows } = await refreshLocalFleetAuthState();
+    // force: same as the --local worker below — this command promises a real
+    // request for every account and --strict gates on it, so the self row must
+    // never reuse the periodic tick's rate-limit-throttled cached verdict. Each
+    // remote peer is force-probed via its own `devices ping --local` worker (see
+    // probeRemoteAuth); the self row must match (RUSH-2998).
+    const { authRows: localRows } = await refreshLocalFleetAuthState({ force: true });
     results.push({ host: self, rows: localRows });
     const remoteTargets = remoteFleetTargets(planned, self).map((t) => ({
         name: t.device.name,
@@ -1000,7 +1006,7 @@ function registerDevicesCommands(program) {
         { title: 'Inspect', names: ['list', 'show', 'status', 'ping', 'harnesses', 'accounts', 'snapshot'] },
         { title: 'Disposable devices', names: ['lease'] },
         { title: 'Configure a device', names: ['config', 'render'] },
-        { title: 'Fleet operations', names: ['update', 'run', 'login', 'pair-ios', 'capture', 'apply'] },
+        { title: 'Fleet operations', names: ['update', 'run', 'login', 'capture', 'apply'] },
     ]);
     devicesCmd
         .command('sync')
@@ -1026,8 +1032,7 @@ function registerDevicesCommands(program) {
     });
     // `agents fleet capture` — snapshot live state into agents.yaml fleet:.
     registerFleetCaptureCommand(devicesCmd);
-    // `agents fleet apply` — same reconcile engine as the top-level `agents apply`,
-    // surfaced under the fleet tree for discoverability.
+    // `agents fleet apply` — canonical fleet reconcile (top-level apply is retired).
     registerFleetApplyAlias(devicesCmd);
     devicesCmd
         .command('register <name>')
@@ -1268,13 +1273,7 @@ function registerDevicesCommands(program) {
      *
      * A role written here lands in that device's tracked per-device doc
      * (`devices/<name>/agents.yaml` `config.role`) and syncs with repo
-     * push/pull. The vocabulary is deliberately `worker | personal` only: a
-     * paired cockpit's `control` role lives in the per-machine device registry,
-     * is written by `agents devices pair-ios`, and is what the existing
-     * dial-exclusion filters (`isControlDevice`) read. Accepting `control` here
-     * too would promise a fleet-wide dial exclusion this key cannot deliver —
-     * those filters read each box's own registry, so the mark would only hold
-     * on the machine that ran the command.
+     * push/pull. The vocabulary is deliberately `worker | personal` only.
      */
     const runDevicesRole = async (name, role, opts) => {
         if (!name) {
@@ -1528,10 +1527,6 @@ function registerDevicesCommands(program) {
 
       Turn the allowlist off with 'agents config set auto.pool all'; a personal
       box stays excluded, since that is what the mark is for.
-
-      A paired iPhone/iPad cockpit is a separate role: 'agents devices pair-ios'
-      marks it control in that box's device registry, and the fleet never dials
-      it — including for placement. This command does not set that role.
     `,
     });
     /** Deprecation notice for a retired subcommand — STDERR only, so a --json consumer's stdout stays parseable. */
@@ -1735,7 +1730,7 @@ function registerDevicesCommands(program) {
                 .map((t) => t.device);
             // Only spin when we'll actually ssh (forced, or a cold/partial cache).
             const cache = readStatsCache();
-            const willSsh = forceRefresh || probeable.some((d) => d.name !== self && !cache[d.name]);
+            const willSsh = forceRefresh || probeable.some((d) => d.name !== self && (!cache[d.name] || !isFreshDeviceStats(cache[d.name])));
             const spinner = willSsh && isInteractiveTerminal()
                 ? ora(`Probing ${probeable.length} device${probeable.length === 1 ? '' : 's'}…`).start()
                 : undefined;
@@ -1991,48 +1986,6 @@ email) into a single row. Use \`agents devices harnesses\` for the per-install v
             process.exit(1);
         }
     });
-    devicesCmd
-        .command('pair-ios [name]')
-        .description('Pair an iPhone/iPad cockpit (RUSH-1733): mint a control token for `agents serve --control` and mark the device control-only. The token is shown ONCE — enter it in the app. Run this on the anchor.')
-        .option('--port <n>', 'Anchor control port to advertise to the app', String(DEFAULT_SERVE_PORT))
-        .action(async (name, opts) => {
-        const label = (name || 'iphone').trim();
-        // Mint the bearer token — hash-only on disk, raw shown once (see serve/token.ts).
-        const { id, token } = addControlToken(label);
-        // If a device with this name is already registered (e.g. discovered over
-        // Tailscale as an `unknown`-platform node), mark it control-only so the
-        // fleet stops trying to dial it for sessions/placement.
-        let marked = false;
-        let unknownName = false;
-        if (name) {
-            const existing = await getDevice(name);
-            if (existing) {
-                await upsertDevice(name, { role: 'control' });
-                setDeviceDiscoveryStatus(name, 'approved');
-                marked = true;
-            }
-            else {
-                unknownName = true;
-            }
-        }
-        const port = parseInt(opts.port ?? '', 10) || DEFAULT_SERVE_PORT;
-        console.log(chalk.green(`Paired cockpit '${label}'`) + chalk.gray(` (token id ${id})`));
-        if (marked)
-            console.log(chalk.gray(`Marked device '${name}' role=control — the fleet won't dial it.`));
-        if (unknownName) {
-            console.log(chalk.yellow(`Note: no registered device named '${name}' — token minted, but no device was marked role=control.`) +
-                chalk.gray(` Run \`agents devices sync\` first if this phone should appear in the fleet.`));
-        }
-        console.log();
-        console.log(chalk.bold('Control token (shown once — enter it in the app):'));
-        console.log('  ' + chalk.cyan(token));
-        console.log();
-        console.log('On the anchor, expose the control server on your tailnet:');
-        console.log(chalk.gray(`  agents serve --control --bind <anchor-tailnet-ip> --port ${port}`));
-        console.log('Then point the app at:');
-        console.log(chalk.gray(`  http://<anchor-tailnet-ip>:${port}   (Bearer: the token above)`));
-        console.log(chalk.yellow('Keep the control server on the tailnet — never public Funnel.'));
-    });
     devicesCmd
         .command('rm <name>')
         .alias('remove')

package/dist/commands/subagents.js

@@ -304,7 +304,7 @@ Examples:
         }
         else {
             console.log(chalk.green(`\nRemoved ${removed} subagent(s) from version homes.`));
-            console.log(chalk.gray('Central source unchanged. Subagents will re-sync on next agent launch.'));
+            console.log(chalk.gray("Central source unchanged. Restore any target with 'agents sync <agent>@<version> --yes'."));
         }
     });
 }

package/dist/commands/view.js

@@ -1241,6 +1241,8 @@ export function parseResourceSections(options, jsonMode) {
  */
 export async function collectAgentsJson(filterAgentId, resourceSections) {
     const agentsToShow = filterAgentId ? [filterAgentId] : ALL_AGENT_IDS;
+    const authCache = readAuthHealthCache();
+    const host = machineId();
     const wantResources = !!resourceSections && resourceSections.size > 0;
     // Only pay for the git-status + resource scans when resources were requested.
     const resourceSync = wantResources ? await loadResourceSyncData() : null;
@@ -1293,6 +1295,7 @@ export async function collectAgentsJson(filterAgentId, resourceSections) {
             isolated: isVersionIsolated(agentId, version),
             isIsolatedDefault: getIsolatedDefault(agentId) === version,
             signedIn: info.signedIn,
+            authVerdict: authCache[authCacheKey(host, agentId, version)]?.verdict ?? null,
             email: info.email,
             accountId: info.accountId,
             organizationType: info.organizationType ?? null,
@@ -1740,8 +1743,8 @@ Output:
   - With agent name: versions for that agent, showing which is the default
   - With a custom harness name: that harness's host, model, provider, and auth
   - With agent@version: detailed breakdown of resources synced to that version
-  - With --json: structured JSON with version, isDefault, signedIn, email, plan,
-    usageStatus, per-window usedPercent, lastActive, and path
+  - With --json: structured JSON with version, isDefault, signedIn, authVerdict,
+    email, plan, usageStatus, per-window usedPercent, lastActive, and path
   - With --prune: plan of which older versions will be removed, then confirm
   - With --prune --dry-run: preview only, no deletions
 `)

package/dist/lib/analytics/mix-commands.d.ts

@@ -7,9 +7,8 @@
  * usage.db) still exists — it is now `agents insights mix` and the recipe
  * subcommands below. Latency stays on `agents perf`; quota on `agents usage`.
  *
- * `agents trends` remains a thin deprecated alias registered from
- * `commands/trends.ts` that shares this same registration — no second copy of
- * the recipe tree.
+ * Former top-level `agents trends` is gone. The nested spelling
+ * `agents insights trends` is an alias of `agents insights mix`.
  */
 import type { Command } from 'commander';
 export declare function parseMixDays(raw: string | undefined): number;
@@ -19,35 +18,14 @@ export declare function printMixSection(section: {
     rows: Array<Record<string, string | number | null>>;
 }): void;
 export declare function renderMixDashboard(days: number, asJson: boolean, bannerLabel?: string): void;
-/** One-line deprecation for the retired top-level `agents trends` spelling. */
-export declare function printTrendsDeprecation(): void;
-export interface RegisterMixCommandsOptions {
-    /**
-     * When true, every action prints the trends deprecation line first. Used only
-     * by the thin top-level `agents trends` alias — the real tree under insights
-     * never sets this.
-     */
-    deprecated?: boolean;
-    /**
-     * Banner label for the multi-recipe dashboard (default: agents insights mix).
-     * The deprecated alias passes `agents insights mix` still, so callers learn
-     * the new name even when they typed trends.
-     */
-    dashboardBanner?: string;
-}
 /**
- * Attach counter-mix subcommands to a parent (typically `insights` or the
- * deprecated `trends` alias).
+ * Attach counter-mix subcommands to a parent (typically `insights`).
  *
  * Layout:
- *   <parent> mix                 multi-recipe board (default for trends alias)
+ *   <parent> mix                 multi-recipe board
+ *   <parent> trends              alias of mix (former top-level `agents trends`)
  *   <parent> recipes             list recipe ids
  *   <parent> query               raw usage.db rows
  *   <parent> harness-mix|…       one baked recipe
  */
-export declare function registerMixCommands(parent: Command, opts?: RegisterMixCommandsOptions): void;
-/**
- * Thin top-level `agents trends` alias: same mix tree, deprecation on every path,
- * default action = mix board (old `agents trends` with no subcommand).
- */
-export declare function registerDeprecatedTrendsAlias(program: Command): void;
+export declare function registerMixCommands(parent: Command): void;